ARKTunnel service persistence via wscl-13 or msvcsrvc

Amit Ambekar@Amit007

•updated 29 days ago•0•0•3

This rule detects the creation of Windows services with specific, potentially suspicious names (wscl-13, msvcsrvc) configured to start automatically on system startup. The detection logic monitors command-line activity from sc.exe or services.exe to identify these specific service registrations.